Submission Summary:

• Submission details:
• Submission received: 28 April 2010, 18:00:39
• Processing time: 6 min 29 sec
• Submitted sample:
• File MD5: 0x8C675DB2EB49640279667A2B74290556
• File SHA-1: 0xC942A35E4A7D73DCA4B09133FC98EE785C1FE444
• Filesize: 168,448 bytes
• Alias:
• Trojan.Zbot [Symantec]
• Trojan-Spy.Win32.Zbot.gen [Kaspersky Lab]
• Mal/FakeAV-CX [Sophos]
• PWS:Win32/Zbot.gen!Y [Microsoft]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\Ewyx\fygys.oxa	326 bytes	MD5: 0x900830A7390EE070CE3C67077BC0AAED SHA-1: 0x85BFD1777BC68795AE230F980F0D893389A8C54E	(not available)
2	%AppData%\Ikty\zygo.exe	169,984 bytes	MD5: 0x2C7359CD5A6CD67FED1986173F8A1195 SHA-1: 0x4F9D70FC9A34E8C2E3DF6DF8060D710AC5DBC171	Trojan.Zbot [Symantec] Packed.Win32.Krap.ae [Kaspersky Lab] Mal/FakeAV-CX [Sophos] PWS:Win32/Zbot.gen!Y [Microsoft]
3	%Temp%\tmpe29b9f53.bat	168 bytes	MD5: 0xD86499507530FE6D7C9A13361811C2A4 SHA-1: 0x23D0D1A46C5A7CDAFB24CC9E1C48A7C95A1EE590	(not available)
4	[file and pathname of the sample #1]	168,448 bytes	MD5: 0x8C675DB2EB49640279667A2B74290556 SHA-1: 0xC942A35E4A7D73DCA4B09133FC98EE785C1FE444	Trojan.Zbot [Symantec] Trojan-Spy.Win32.Zbot.gen [Kaspersky Lab] Mal/FakeAV-CX [Sophos] PWS:Win32/Zbot.gen!Y [Microsoft]

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directories were created:
• %AppData%\Ewyx
• %AppData%\Ikty

Memory Modifications

• There was a new memory page created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
cmd.exe	%System%\cmd.exe	212,992 bytes

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\Microsoft\Kyergi

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• {909000F9-A5C2-668D-9FD0-CD9ADCC27381} = ""%AppData%\Ikty\zygo.exe""

so that zygo.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Kyergi]
• Oxtoqoyf = 7D 1A 8F 87 40 83 9B 79 82 DF EB 1B 29 F7 32 CF 95 DD D1 7D F9 52 E2 73 C3 A0 BF 24 D9 1A DD 61 89 7B C5 F2 FE FE 6C FF 94 AB 5B 86 B2 A8 F0 AD 36 62 D7 35 F9 F6 04 AC 3B 23 3B 2B F4 74 48 9B 55 03 E4 EA 54 8F D0 3D 00 76 F4 A0 D5 98 8D A7 66 14 F6 8
• Ylxecy = F4 42 D1 58 ED E5 9E 72 0C 27 03 BD 7D 4B 30 AE 05 DF 4B 6E 5F 62 D3 42 F2 91 8E 15 3A F9 3E 82 1E C8 9B 31 4A 49 B2 18 D2 F9 5A A2 8D F6 17 CC 76 6C 28 4B F7 F8 0A B2 21 39 21 31 EA 6A 56 85 4A 1C FB F7 6B FE A1 4C 71 07 85 C1 AA E7 F2 D8 07 75 97 E

Other details

• There were registered attempts to establish connection with the remote hosts. The connection details are:

• The data identified by the following URLs was then requested from the remote web server:
• http://b-care.jp/file/50/t.cfg
• http://www.google.com/webhp
• http://77.221.153.143:8080/t2/g.php